hub v0.105.0: the third name, a machine told to be quiet, and a guard for the hub's own words

Hub only. No controller change, no agent change, no wire change — nothing to bake.
demo-hp untouched: the operator is re-deploying it this evening.

R-323 — the five-word phrase is „Tulajdonosi jelmondat". It was „Visszaállító
jelszó": one word from the name retired last week, and false besides — it restores
nothing, it proves the account owns the box being bound. Five sites, all in the hub;
felhom-controller and felhom-agent carry the name nowhere, so no halt and no bake.
Both suggested names were rejected with reasons: „Fiókjelszó" would collide with the
dashboard login (a DIFFERENT real secret), and „Összekötési jelszó" would leave the
two factors on this page separated only by kód-versus-jelszó — the exact shape being
removed, since the other factor is the „Párosító kód". The chosen name differs on
both axes, stem and noun. Naming only; the acceptance pin drives the real handler.

R-324 — the hub's customer copy is under a guard for the first time. Retired names
banned across all 95 hub files; retrieval stems registered in four declared customer
surfaces. The selftest found a defect in its own instrument on the first run. One
shared vocabulary in scripts/, drift-checked into the controller gate rather than
copied (R-325 removes the scaffold).

R-321 — a machine we told to be quiet is no longer reported as dead, and it was two
doors, not one: because the state is RECORDED rather than deleted, the morning
deadline check can skip it too. A deleted state returns "", which is not "down" —
R-195's shape returning through a second door. The clock runs from the report the hub
can see, so re-enabling starts it there and emits no recovery for an outage that never
happened. Three red-proofs; the one that matters showed a genuinely dead machine
sitting at "disabled" when the suppression was made unconditional.

R-326 — "which claims are unproven" is answerable by a command now. The nine I have
been repeating was the count of claims the 9 August pass DOWNGRADED, not the count of
unproven ones. The real figures: 55 claims, 23 walked, 32 not — and only 6 of those 32
cite evidence. Its first run found a stale claim (R-327).

STATUS.md

@@ -1,6 +1,6 @@
 # STATUS — what works, what's broken, what's next
 
-**Updated 2026-08-13 (evening — the small debts, and one fact given a reader).**
+**Updated 2026-08-13 (late — the third name, a machine told to be quiet, and a picture you can query).**
 
 > **A view, not a source.** `documentation/backlog/OPEN-ITEMS.md` is the authority; this page restates
 > part of it in plain words, and **nothing may exist only here**. **Items, not paragraphs. One screen.**
@@ -57,6 +57,16 @@ record with no machine** — created 13 August, no host, no backups, nothing to
 - **The hub can see whether a machine's guest still has working networking** (R-319, first reader built
   against R-264). A machine quietly repairing its own network over and over is now visible instead of
   being a green tick; a machine that does not report it is drawn as unknown, never as healthy.
+- **The third secret has its own name** (R-323, on your ruling). The five-word phrase that proves an
+  account owns the box being linked is „Tulajdonosi jelmondat". It was „Visszaállító jelszó" — one word
+  from the name we retired last week, and false besides: it restores nothing. Five places, all in the
+  hub; no machine touched.
+- **A machine we tell to be quiet is no longer reported as dead** (R-321). It went stale, then down,
+  then e-mailed you twice about a silence you asked for. It turned out to be two alarms, not one — the
+  morning backup reminder had the same blind spot and is fixed with it.
+- **The hub's own words are under a guard** (R-324). Every customer e-mail and the linking pages are
+  now checked for a retired name, and the guard has been watched catching one, ignoring an
+  explanation of one, and going quiet again.
 - **The countdown on `demo-felhom` is cancelled** on your ruling (R-307). Nothing was deleted.
 
 ## Broken, or knowingly incomplete
@@ -75,9 +85,16 @@ record with no machine** — created 13 August, no host, no backups, nothing to
 - **Three more facts the machines send still have no reader** (R-264): a staged-but-unapplied agent
   update, how deep a restore test actually went, and the two backup-integrity timestamps. Five others
   are now recorded as deliberately unread, which is honest rather than fixed.
+- **Two thirds of the standing picture is still unproven, and now you can ask** (R-326).
+  `python3 scripts/unproven.py` lists it: of 55 claims, **23 are walked and 32 are not** — and of
+  those 32, only 6 point at an evidence document. **The "nine" I have been repeating was wrong**: nine
+  is how many claims the 9 August review *lowered*, which is a different question.
+- **The picture still describes one defect we have since fixed twice** (R-327) — the naming claim. Its
+  status may only be raised after the capability map moves first, which is a separate judgement.
 
 ## Working on next
 
-The three remaining R-264 readers, now that one has been built and we know what one costs; then R-317
-(one line in the agent); then the 2026-08-09 batch (R-279 … R-292), still untriaged against everything
-since.
+`demo-hp` is yours this evening — **this session did not touch it**. After that: the three remaining
+R-264 readers, now that one has been built and we know what one costs; R-317 (one line in the agent);
+R-327 (decide what the naming claim's status should be); then the 2026-08-09 batch (R-279 … R-292),
+still untriaged against everything since.